bcrypt Generator

Need a bcrypt hash right now — for a seed file, a test fixture, a .htpasswd entry, a database migration — without installing anything? Type a password, pick a cost factor, and get a standards-compliant $2b$ hash with a fresh random salt in about a second. Every click generates a different hash for the same password, exactly as bcrypt is supposed to behave; if two runs ever matched, the salt would be broken.

The cost slider goes from 4 to 16 with a live time estimate calibrated to your device, so you can feel what 2^cost actually means before you commit to a value in production. The tool also watches bcrypt's most infamous gotcha for you: passwords are limited to 72 bytes (bytes, not characters — multibyte UTF-8 eats the budget fast), and a counter under the input warns you the moment you cross it. The output breaks down into its anatomy — prefix, cost, 22-character salt, 31-character digest — so you can see precisely what each part of the modular crypt string means.

Generation runs in a WebAssembly worker thread on your machine. The password is never transmitted, never logged, never stored — disconnect from the internet and the generator keeps working.

FAQ

What cost factor should I generate with?

Cost 10 is the widely used default and a good balance today. Each step up doubles the work: 12 is roughly four times slower than 10. Aim for the highest cost that keeps hashing under ~250ms on your *server* hardware — the on-device estimate here gives you a feel for the scaling.

Why is my hash different every time I generate?

Because a fresh 16-byte random salt is generated per hash, and the salt is embedded in the output (the 22 characters after the cost). Same password, different salt, different hash — all of them verify against the original password.

Is it safe to generate a password hash in a browser?

Here, yes: the hashing happens locally via WebAssembly and nothing is sent anywhere. As a general rule, though, never type real production passwords into random websites — and rotate any password you've pasted into a third-party tool.